At the Ethernet level, each station (or node) listens for traffic destined to its physical (MAC) address. In Chapter 6, we discussed the layered model of the ISO OSI. This model can help your understanding here because when TCP/IP traffic has been encapsulated into an Ethernet frame, the destination Ethernet address is also added. However, at this level, the IP address does not come into play because this is purely Ethernet-based addressing. So how does the sending machine know what Ethernet address local traffic should have?
TCP/IP uses Address Resolution Protocol (ARP) to match an IP address to a local (to the network) address. When a machine needs to send data to a machine on its local network, it sends an ARP broadcast asking, "Who has the IP address 192.168.0.233?'' The 192.168.0.233 machine (if alive) will respond saying, "I have that IP address, and my MAC address is XYZ.'' The sender then uses this MAC address as the destination in the Ethernet frame when it needs to send data to the 192.168.0.233 machine.
Now, if every time data needs to be sent to 192.168.0.233 the sending host were to do an ARP lookup, the transfer of data would be slowed. To combat this, Linux keeps an ARP cache. This cache contains a lookup table, correlating the IP address to the destination MAC address.
To view the ARP table, use the command arp (see Listing 15-6). In the following output, you can see how an IP address is correlated to a MAC address — for example, IP address 192.168.0.1 is associated with MAC (hardware) address 00:00:0F:00:00:01.
Was this article helpful?